bpfman / bpfman/bpfman-operator

SELinux Profile Bindings don't seem to work

Open
#462 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
38
Forks
27
PR merge metrics
No merged PRs in 30d

Description

In the daemonset object, when the customer specifies the selinux profile explicitly using securityContext->seLinuxOptions->type, the profile gets assigned as [expected.]
If the customer removes that part, the customer thought that using a security profile binding would be sufficient in order to have the profile injected automatically (by the mutating webhook the cutsomer assume).
But when the customer checks the pod specs the selinux type is empty and the container context is set to the default container_t.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how the operator handles security profile bindings and whether a mutating webhook processes DaemonSet pods. Compare pod specs with and without securityContext->seLinuxOptions->type, then verify that the binding produces the intended SELinux type rather than the default container_t.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, linux
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.